The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs users to execute multiple local Python scripts using uv run or python, including evaluation_manager.py, run_eval_job.py, and run_vllm_eval_job.py. These scripts perform operations such as repository inspection and data extraction.
[REMOTE_CODE_EXECUTION]: The skill facilitates the submission of evaluation jobs to Hugging Face infrastructure via the hf jobs uv run command. Additionally, it mentions the --trust-remote-code flag in its troubleshooting section; while this is a standard parameter for the Hugging Face Transformers library, it enables the execution of arbitrary Python code defined within a remote model repository.
[EXTERNAL_DOWNLOADS]: The skill fetches benchmark data from the Artificial Analysis API (artificialanalysis.ai) and interacts with the Hugging Face Hub to download model metadata and README files. It also references task definitions hosted on Hugging Face's official GitHub repository.
[CREDENTIALS_UNSAFE]: The skill requires the use of sensitive authentication tokens, specifically HF_TOKEN for repository access and AA_API_KEY for benchmark imports. The documentation recommends managing these via .env files or environment variables, which is a standard security practice for development tools.
[PROMPT_INJECTION]: The skill processes untrusted markdown content from model README files to extract evaluation tables. While it uses a structured parser (markdown-it-py) and token matching to minimize errors, the ingestion of external repository content creates a surface for indirect prompt injection if an attacker were to craft a malicious README to influence the extracted metadata.

hugging-face-evaluation